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1. Introductions and apologies 


1.1. Elizabeth Denham extended her apologies for the meeting. 


2. Declaration of interests 


2.1 There were no declarations made. 


3. Matters arising from the previous meeting 


3.1 The minutes of the previous meeting were agreed by email. 
There were no issues arising. 
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Chris Braithwaite provided an update on the actions. He 
reported that the Whistleblowing Policy was currently being 
reviewed alongside other HR policies and will be finalised in 
July, following consultation with the Trade Unions. 


Action: Corporate Governance to circulate the 
Whistleblowing Policy to Audit Committee once 
updated. 


4. Deputy Chief Executive Officer’s update 


4.1 


4.2 


Paul Arnold provided an update on matters relating to the 
Committee’s work, including an update on the ongoing 
business continuity response, working with the EDI Forum in 
relation to Black Lives Matter, finance, regulatory posture 
during COVID-19 and the recent publication of the police 
Mobile Phone Extraction report. 


Ailsa Beaton raised a question relating to capacity and 
absence. Paul Arnold confirmed that reported capacity 
remains static at around 80% and currently sickness absence 
is not noticeably higher than usual. The wellbeing staff survey 
which is being sent out this week will help to capture 
information on how staff are coping in the current situation, 
particularly regarding mental health wellbeing. 


5. External Audit 


5.1 


5.2 


The NAO Completion Report was circulated separately to the 
papers on Friday. David Eagles stated that the new ways of 
working had led to delays to the completion of the external 
audit as well as a number of outstanding audit issues and 
apologised for the delay. 


The Committee discussed the outstanding issue of IFRS16. 
NAO confirmed that implementation of this has been a 
challenge across Arm’s Length Bodies and that the progress 
made by the ICO with this implementation has been very 
positive. 


NAO confirmed that they are awaiting a decision from 
Treasury regarding the reasonable discount rate for IFRS16 
which need to be taken into account on the final report. Roger 
Barlow commented that it was unacceptable to still be 
awaiting a discount rate at this stage and queried whether, as 
the ICO had disclosed the discount rate it would use in the 
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current draft of the accounts, this discount rate could be used 
instead of waiting for a decision from Treasury. David Eagles 
explained that they would consider the discount rate set by 
Treasury to be the reasonable rate and therefore the ICO 
Annual Report could not be signed off until DCMS and HMT 
had resolved the issue. 


David Eagles, representing the external auditors, highlighted 
key areas in the external audit report. He confirmed that 
unadjusted items would need the Audit Committee support to 
the representation letter; there were no concerns regarding 
management override; and it has been agreed that civil 
monetary penalties would not be recognised until appeal 
rights are over. 


The pay rise for 2019/20 has been accounted for as a 
provision, rather than an accrual as had been the case for 
2018/19. Roger Barlow asked whether the 2018/19 pay rise 
could be reflected as a provision in the 2019/20 accounts, to 
ensure comparability between the previous year. David Eagles 
explained that as the amount in question was not material, it 
would not be appropriate to make a prior period adjustment. 


The Committee noted that Mazars’ forensic accountants had, 
as part of their review into the 2018/19 pay rise, agreed that 
it had been treated as an accrual rather than a provision and 
had confirmed that this had been an error but that there was 
no intent by management to mislead on the provisions in the 
2018/19 accounts. 


The Committee reviewed the timeline for the Annual Report. 
NAO confirmed that they usually recommend a week for 
review and sign off of the report however, under the 
circumstances, this would be able to be reduced. 


The following timeline for the annual accounts was agreed: 
e Circulation to Committee members for agreement by 
close of play 2 July. 
e All comments to be received no later than lunchtime on 
6 July. 


The Committee discussed the going concern statements in the 
draft annual report and accounts and confirmed that they 
were content that the ICO remained a going concern. NAO 
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confirmed that they are satisfied that the ICO remains a going 
concern and the accounts are submitted on that basis. 


6. Internal Audit 


6.1 


6.2 


6.3 


6.4 


6.5 


Follow Up Report 


Peter Cudlip presented the report which confirmed that 79% 
of the recommendations have been implemented. 


The Committee approved the proposed closure of 
recommendations and were happy with the recommendations 
marked as superseded. 


Andrew Hubert confirmed that accountability for budgets are 
at Senior Leadership level and regular budget meetings are 
held between Finance and Directors. 


Annual Report 


Peter Cudlip confirmed a moderate assurance for the annual 
report which is an improvement on last year. 


Ailsa thanked the Executive and teams for their work on the 
internal audits. 


7. Annual Report 


7.i 


7.2 


7.3 


7.4 


Ailsa confirmed that the ICO has met the minimal cyber 
standards. The Arm’s Length Bodies letter from the Chair was 
approved with the recommended amendments. 


The Committee reviewed and approved the revised Audit 
Committee annual report, subject to minor amendments. 


There were no issues raised and it was confirmed that the 
report will be circulated once the outstanding reviews have 
been completed by NAO and BDO, for final agreement via 
email. 


Roger Barlow commented that the planning and timeline for 
the production of the annual report has been very useful and 
the finished result is a high quality report. 


8. Risk and Opportunity Management 


8.1 


Louise Byers highlighted that we are in a fast moving 
environment and are keeping a watching brief on many of the 
risks. 
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The Committee agreed to the reduction of the finance and 
productivity risks. 


It was highlighted that the two international risks have been 
combined and a new risk is being developed relating to the 
data prospects work and constitutional review. 


The Committee agreed to conduct a deep dive at its next 
meeting into the new ways of working, current and in the 
future. This should include looking at the positives of the 
current working environment but also recognising that it may 
not have been a positive experience for all members of staff. 


Jane McCall asked whether the reputational risk should be 
reviewed. Louise Byers confirmed that the reputational, 
productivity and wellbeing risks will be kept under an ongoing 
review. 


A general point was raised regarding information assets and 
security. It was recognised that as the current situation 
continues, staff would be under increased pressure and the 
likelihood of human error for information disclosure increases. 
It was confirmed however that there have been no reports of 
increased disclosures under the current circumstances. 


Peter Cudlip offered to meet with the ICO to share lessons 
learned about the current remote working circumstances from 
across their clients. 


Action: Corporate Governance to arrange a meeting 
with Mazars to discuss lessons learnt on remote 
working and benchmarking. 


9. Information Risk & Governance Update 


9.1 


9.2 


9.3 


Louise Byers presented the report providing an update on the 
progress of the Information Risk & Governance Board which 
provides assurance and oversees the ICO’s information 
governance work. 


It was confirmed that the Board also reviews on a monthly 
basis the cyber security dashboard which provides assurance 
to the Audit Committee that we are meeting the required 
cyber security standards. 


It was agreed that an update report should be provided to the 
Committee on an annual basis at the April meeting. 


Draft 5 


Draft 


10. Finance 


10.1 Andrew Hubert confirmed that we are on track for the revised 
fee income projections and will continue to monitor this 
closely. 


10.2 There were no issues raised. 

11. Outstanding Audit Recommendations 
11.1 No comments raised. 

12. Single tender contract awards 

12.1 There were no contract awards at this time. 
13. Any other urgent business 


13.1 Roger Barlow suggested that Finance, NAO and BDO conduct 
a debrief as soon as the annual accounts have been finalised 
with a lessons learnt report coming to the next meeting. 


Action: Corporate Governance to ensure that a lessons 
learned report on the production of the annual report 
and accounts is submitted to the Committee’s next 
meeting. 


13.2 Ailsa thanked everybody for their efforts and asked for the 
annual report to be finalised by the agreed dates at the 
beginning of July. 
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